Key takeaways
- Define a repeatable risk assessment method, assess information security risks, choose treatment options and controls, compare against Annex A, and produce a Statement of Applicability and risk treatment plan.
- Planning for risks and opportunities makes sure the ISMS achieves its outcomes and prevents surprises.
- Start here: use the context and interested party inputs to identify risks and opportunities.
Purpose
Define a repeatable risk assessment method, assess information security risks, choose treatment options and controls, compare against Annex A, and produce a Statement of Applicability and risk treatment plan.
Requirement
Requirement summaryWhen planning for the information security management system, the organization shall consider the issues referred to in 4.1 and the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed to: a) ensure the information security management system can achieve its intended outcome(s); b) prevent, or reduce, undesired effects; c) achieve continual improvement. The organization shall plan: d) actions to address these risks and opportunities; and e) how to - 1) integrate and implement the actions into its information security management system processes; and - 2) evaluate the effectiveness of these actions
Why it matters
Planning for risks and opportunities makes sure the ISMS achieves its outcomes and prevents surprises.
How to implement
- Use the context and interested party inputs to identify risks and opportunities.
- Plan actions to address them.
- Integrate actions into ISMS processes.
- Plan how you will evaluate their effectiveness.
What evidence you need to provide
Here is what you will typically need to provide for Clause 6.1.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your approach to planning: how risks and opportunities from your issues and interested parties are identified.
Records and examples to show
- Your risk register showing risks linked to those issues and needs.
- Plans showing how actions are built into everyday work and how you check they worked.
Things you should be able to show or explain
- Be able to explain how planning connects to the business.
How much to show: The register and two or three actions.
Common mistakes
- Planning disconnected from real issues.
- Opportunities ignored.
- Only considering risks, never opportunities.
- Actions planned but not tracked.
- Tip: Your Statement of Applicability is the document auditors ask about most. Make it tidy!
Policies & documents to have
- Master list of ISMS documents
- ISMS scope statement
- ISMS roles, responsibilities and authorities document
- Risk assessment and treatment methodology
- Corrective action and continual improvement procedure
- Information security objectives plan
FAQ
Can we exclude clause 6.1.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A consistent method, risk owners, sensible results, and an SoA that justifies inclusions/exclusions.